Denial-of-Service Vulnerability in vCenter Server by VMware
CVE-2021-22019

7.5HIGH

Key Information:

Vendor
Vmware
Status
Vmware Vcenter Server, Vmware Cloud Foundation
Vendor
CVE Published:
23 September 2021

Summary

The vCenter Server is susceptible to a denial-of-service vulnerability affecting the VAPI (vCenter API) service. An attacker with access to the server's network can exploit this vulnerability by sending a specially crafted JSON-RPC message to port 5480. This can lead to a denial-of-service condition, disrupting the functionality of the vCenter Server and impacting its availability.

Affected Version(s)

VMware vCenter Server, VMware Cloud Foundation VMware vCenter Server(7.x before 7.0 U2c, 6.7 before 6.7 U3o and 6.5 before 6.5 U3q) and VMware Cloud Foundation (4.x before 4.3 and 3.x before 3.10.2.2)

References

https://www.vmware.com/security/advisories/VMSA-2021-0020...
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.